Troja vs. OffURL: which website security scanner wins?

Short version: OffURL is a no-signup security scanner built for vibe-coders — 150+ checks, CVE lookup, threat-intel feeds and a refreshingly simple $1.99-per-report model. Troja does security too, but adds AEO (can AI answer engines cite you?), connected deep-stack scans of your real GitHub, Supabase, Stripe, Vercel, Railway and Resend, active authenticated tests, monitoring and an MCP server. Want a cheap one-off external audit? OffURL is excellent. Want to scan the stack behind the page and fix it in your editor? That's Troja.

What is OffURL?

OffURL (offurl.com) runs 150+ checks across 16+ categories in about 30 seconds, no account needed. It's unusually deep on pure security: application security (XSS, SQL injection, SSRF, SSTI, LFI/RFI, CORS), active pen-tests (CRLF, command injection, rate-limiting), CVE lookup via the NVD API, subdomain-takeover detection, threat-intelligence feeds (URLhaus, PhishTank, Feodo), a complete email-auth suite (SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT), WCAG accessibility and domain intelligence (WHOIS, domain age, Archive.org history). The fix model is a paste-ready LLM prompt template for Claude, Cursor or Grok. Pricing: your first premium report is free, then $1.99 per report — no subscription.

Troja vs. OffURL at a glance

Where OffURL is strong

OffURL has the broadest pure-security surface in this category — CVE cross-referencing, live threat-intel feeds, subdomain-takeover detection and a full email-authentication suite (it even checks BIMI, MTA-STS and TLS-RPT, which most scanners skip). The pay-per-report pricing is genuinely friendly for a one-off pre-launch audit, and there's no signup wall.

Where Troja goes further

Three gaps matter for builders. First, AEO: OffURL won't tell you whether ChatGPT or Perplexity can cite you, and AI answer engines are now a real traffic source. Second, connected deep-stack scanning — OffURL only sees the public page, while Troja uses read-only tokens to find leaked secrets in your GitHub source, permissive Supabase RLS, weak Stripe webhooks and misconfigured hosting. Third, the fix loop: OffURL gives one prompt template; Troja writes a tailored fix prompt per finding, streams them into your editor over MCP, and re-tests them with one click — plus monitoring, white-label reports and an API.

Which should you choose?

• You want a deep, cheap, one-off external security audit with no subscription → OffURL.
• You also need AI-visibility, your real backend scanned, and an ongoing fix-and-monitor loop → Troja.

Both are strong. OffURL is the better à-la-carte security checkup; Troja is the better home base if security, search and AI visibility all live on your plate.